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ABSTRACT 

This paper reports on research into the field of computer 
security, and undergraduate degrees offered in that field. Research described 
in the paper reveals only one computer security program at the associate's 
degree level in the entire country. That program, at Texas State Technical 
College in Waco, is a 71-credit-hour program leading to an Associate of 
Applied Science in Network Technology degree and focuses heavily on computer 
networks and operating systems, containing courses that prepare individuals 
for careers on corporate security teams. The majority of computer security 
and information security training is offered in master's and doctoral-level 
programs. The paper proposes Norwalk Community College (NCC) in Norwalk, 
Connecticut, develop a new degree program at NCC. It also details the process 
of developing the degree program, starting with advisory committee members 1 
development of a knowledge and skills list for entry-level computer security 
professionals, identification of the components that could be taught in a 
formal program of study, and the packaging of knowledge and skills components 
into logical course delivery units. The paper argues for development of 
similar programs at other community colleges. (NB) 
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This paper describes the process of creating a degree program in Computer 
Security at Norwalk Community College (NCC), in partnership with a program 
option in Information Security Management at Western Connecticut State 
University (WCSU). The events are described in chronological order, as follows: 



Awareness and Verification of Need 


April 2001 


The Research 


April 2001 - May 2001 


The Idea 


June 2001 


The Contacts 


July 2001 - October 2001 


The Process 


October 2001 - January 2002 


Knowledge and Skills List 




Components 




Courses and Gaps 




The Degree Approval Process 


February 2002 - September 2002 



Awareness and Verification of Need (April 2001) 

In April 2001, a number of articles appeared in national IT weekly periodicals 
(e.g., ComputerWorld, eWeek, Information Week, InfoWorld) concerning the 
scarcity of trained computer security professionals in the United States. The 
articles referenced a high demand for these individuals in both the public and 
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private sectors, and an insufficient number of qualified applicants to fill these job 
openings. Dr. Belon felt it was necessary to verify the shortage of trained 
computer security professionals among regional companies. 

Since Connecticut’s Fairfield County is heavily populated with producers of IT 
products and services, Dr. Belon informally contacted several of the area CIOs. 
All of them confirmed that they had serious problems hiring qualified computer 
security personnel. 

If such a high demand existed for this skill set, then there was a mismatch 
between those in need of skilled professionals, and those who could provide 
qualified candidates. 

The Research (April 2001 - May 2001) 

The search to find existing computer and information security education 
programs began in earnest in late April 2001 . Several Internet search engines 
(e.g., Google, Lycos, AltaVista, Yahoo) were used to locate colleges and 
universities that had accredited degree programs in either computer security or 
information security. Many Master’s and Doctoral degree programs in computer 
science and information systems were found, most containing only electives in 
information security or cryptography. Further research identified the twenty-three 
schools that were certified as NSA Centers of Academic Excellence in 
Information Assurance Education. However, no focused degree programs in 
cybersecurity were found at the Bachelor’s level. At the Associate’s degree level, 
one program at Texas State Technical College (Waco, TX) was identified. That 
particular seventy-one credit hour program, leading to an Associate of Applied 
Science in Network Security Technology, focused heavily on computer networks 
and operating systems, and contained security assessment and e-commerce 
security courses that prepared individuals for careers on corporate security 
teams. 

It was apparent that the available resources to train computer security and 
information security professionals were being poured into the Master’s and 
Doctoral level programs. Therefore, it was no wonder that there were not 
enough entry-level security professionals to meet corporate demand. Clearly, 
the single Waco, TX program could not produce the numbers necessary for the 
U.S. market. Other undergraduate degree programs that were focused on 
computer security and information security were needed to satisfy the growing 
demand for professionals in this relatively new field. 
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The Idea (June 2001) 

In June 2001 , Dr. Belon presented the idea of developing a new degree program 
in Computer Security to NCC’s president and academic dean. They both 
endorsed the idea and urged Dr. Belon to continue with her research and begin 
to make contacts at universities that were known to have graduate programs in 
computer security or information security. The president of NCC also placed the 
potential degree development project on the agenda for the next meeting of the 
President’s IT Advisory Committee; a group comprised of CIOs and CEOs from 
area companies. At their June meeting, the committee members approved the 
idea of developing a Computer Security degree at NCC, articulated with a four- 
year school. 

The Contacts (July 2001 - October 2001) 

NCC Director of Grants and Strategic Planning, Ms. K.C. Senie, assisted Dr. 
Belon in identifying personnel who were involved in university computer security 
programs. One of her contacts was with Alan Berg, Administrative Director of the 
INFOSEC program at James Madison University (Harrisonburg, VA). While 
discussing James Madison’s program and NCC’s desire to partner with a four- 
year institution, Mr. Berg suggested that Ms. Senie contact Dr. Marie Wright, a 
faculty member at nearby Western Connecticut State University. 

Near the end of August 2001, Ms. Senie contacted Dr. Wright, and discussions 
ensued on the potential to jointly develop a degree program in Computer 
Security. The idea proposed was that NCC would offer hands-on lab courses in 
networks and operating systems and introductory security courses, while WCSU 
would offer the more advanced theoretical courses in information security 
through their existing Information Security Management program option. 

A meeting was arranged on September 14, 2001 . The invited group consisted of 
faculty and administrative representatives from NCC, WCSU and the CT 
Technology College. Discussions focused on NCC’s proposal to develop an 
Associate’s degree program in Computer Security that would mesh with the 
existing Bachelor’s degree program in Management Information 
Systems/Information Security Management at WCSU. The likelihood of 
developing a program articulation between NCC and WCSU also was discussed, 
as was the potential for articulations with other four-year institutions in the state. 

Following the meeting, Dr. Belon prepared a draft articulation agreement, which 
paired the general college core courses in WCSU’s degree requirements with 
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those offered at NCC. This was delivered to WCSU on September 26, 2001, and 
it met with the approval of WCSU’s MIS department and administration shortly 
thereafter. 

During the last week in September, Dr. Belon and Dr. Wright felt that it was time 
to assemble an advisory committee of computer and information security 
professionals from the region for the purpose of creating the new degree 
program. At Dr. Belon’s request, the local Society for Information Management 
(SIM) chapter in Fairfield County e-mailed their membership, telling them about 
NCC’s proposed Computer Security program, and asking anyone with relevant 
work experience to contact Dr. Belon if they were interested in helping to draft 
the program/course content. The e-mail was sent out on October 2, 2001 . On 
October 3, calls were received from twelve security professionals representing 
government, academia, and industry who were interested in participating in the 
degree development process. 

The newly formed Computer Security Advisory Committee membership 
consisted of the following: 

Four individuals from NCC, representing faculty and administration 
Four individuals from area businesses, all actively involved in their 
respective companies’ security endeavors 
Four individuals from state and local law enforcement 
Four individuals from regional four-year higher education institutions 

The first Computer Security Advisory Committee meeting was set for October 24, 
2001 . 

The Process (October 2001 - January 2002) 

At the first advisory committee meeting, the members were charged with the 
development of three items: 

1) Knowledge and Skills List - a listing of the knowledge and skills needed 
by entry-level computer security professionals 

2) Components - those knowledge and skill components that could be 
taught in a formal program of study, as opposed to the knowledge and 
skills that are learned on the job 

3) Courses and Gaps - the packaging of knowledge and skill components 
into logical course delivery units, and the identification of those 
components that were not covered in any of the existing courses at either 
NCC or WCSU (i.e., the gap analysis) 
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These tasks were to be completed over the course of the next two months. 
Knowledge and Skills List 

During the first advisory committee meeting, most of the time was spent on the 
first task. The committee members were asked to list the skills needed for jobs in 
computer and information security. After compiling the list, the committee was 
guided back through the items, and these were discussed, with more skills added 
and others deleted or combined for clarity. Some discussion time also was given 
to the definition of entry-level security positions and what skills would be 
demanded. 

On October 30, 2001 , Dr. Belon met with Dr. Wright at WCSU to recap the first 
advisory committee meeting, and to move the knowledge and skills listing to the 
next level. Discussions progressed along two lines. First, the knowledge and 
skills needed for entry-level security jobs, as identified by the advisory committee 
members, were supplemented by numerous security job descriptions that Dr. 
Wright had compiled from online regional job postings. Then, the knowledge and 
skills identified by certification bodies, such as SANS (the System Administration, 
Networking and Security Institute) and ISC2 (the International Information 
Systems Security Certification Consortium, Inc.), were incorporated into the 
existing knowledge and skills list. The objective was to synthesize the 
knowledge and skill requirements prior to next advisory committee meeting, so 
that the committee members would be prepared to review and modify the 
summary listing of skills. 

The finite list of knowledge and skill requirements that was produced at the 
October 30 meeting was e-mailed to the advisory committee members. The 
members were directed to review the items and be prepared to support their 
inclusion, deletion or modification at the next advisory committee meeting. 

Components 



On November 14, 2001 , the second Computer Security Advisory Committee 
meeting was held at NCC. Rather than concentrate on the specific knowledge 
and skills required for particular security jobs (e.g., security analyst, security 
administrator), it was decided that job titles should be put aside in order to 
produce a summary list of requisite knowledge and skill requirements. This list 
would represent the critical knowledge and skill components that the students 
should have in order to pursue productive careers in computer and information 
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security. During the course of the meeting, additions and revisions were made to 
the list. 

On November 27, 2001 , Dr. Belon and Dr. Wright met at WCSU. Dr. Wright had 
reorganized the knowledge and skill requirements identified by the advisory 
committee members into categories that aligned with the ICS2 Common Body of 
Knowledge topical areas, and supplemented the knowledge and skills 
requirements list with additional knowledge requirements from ISC2 and the 
NSTISS (National Security Telecommunications and Information Systems 
Security) standards. 

On November 28, 2001 , the third Computer Security Advisory Committee 
meeting was held at NCC. Committee work entailed the finalization of 
knowledge and skill set requirements, along with the sequencing of those items. 
Final agreement was reached on the content of the Computer Security degree 
program. 

At this point, the work fell to Dr. Belon and Dr. Wright to match the identified 
knowledge and skill set requirements to the content of courses currently offered 
at NCC and WCSU. 

Courses and Gaps 

From December 2001 through January 13, 2002, Dr. Belon and Dr. Wright 
worked on the identification of existing courses at NCC and WCSU that covered 
the specified knowledge and skill requirements. Those program skills and 
knowledge components that could not be matched with existing course content 
were referred to as “gaps”. Once the gaps were identified, they were studied to 
see how they could be packaged into new courses. Dr. Belon initially outlined 
four new courses that were needed to deal with the gaps. However, after further 
analysis, it was determined that the number of new courses required could be 
reduced to three. 

During this time, Dr. Belon also completed writing the degree application 
package that would be submitted to the various approval bodies within 
Connecticut for accreditation and licensure of the program. By January 13, 2002, 
both Dr. Belon and Dr. Wright felt that the packaging of the skills and knowledge 
elements could be presented to the advisory committee for their review and 
approval. 




7 



Page 6 



Case Study: Creation of a Degree Program in Computer Security 



On January 16, 2002, the fourth meeting of the Computer Security Advisory 
Committee was held at NCC. Committee members reviewed the course 
coverage and sequencing that had been prepared by Dr. Belon and Dr. Wright, 
examined the content of the three proposed courses, and made suggestions 
regarding the proposed course sequencing. All members present gave their 
approval for moving the completed degree application forward through the 
academic approval process. During the following week, the remaining committee 
members who had not been able to attend the January 16 meeting had e-mailed 
their comments and given their approval. 

By the end of January 2002, the program articulation agreement between NCC 
and WCSU for the Computer Security degree program had been revised to 
streamline the student transfer process. 

The Degree Approval Process (February 2002 - September 2002) 

The formal application for accreditation and licensure of the Associate of Science 
in Computer Security was presented to the NCC Computer/Information Systems 
department at its February 2002 meeting. The department summarily approved 
the three proposed security courses, as well as the total degree package. 
Immediately afterwards, the application received the academic dean’s support 
and signature. The degree package then was forwarded to the NCC Curriculum 
Committee chairperson for distribution and action at their March 20, 2002 
meeting. 

In the meantime, at the early March meeting of the President’s IT Advisory 
committee, the President of NCC was urged to call a special faculty meeting in 
order to expedite faculty approval of the Computer Security degree program. He 
acted accordingly and scheduled the meeting on April 8, 2002. 

On March 20, the NCC Curriculum Committee voted to approve the Computer 
Security degree program and the three new courses. However, at the end of the 
meeting, concerns were raised that the liberal arts requirement might not be met, 
depending on the electives a student selected. Since there was a chance that 
the degree program might be voted down when presented to the full faculty on 
April 8, Dr. Belon successfully petitioned the Curriculum Committee to accept a 
one-course addition of another liberal arts elective to the application. 

On April 8, 2002, the NCC faculty approved the degree application. The meeting 
was contentious. Although the substance of the degree program received strong 
faculty support, a major concern was expressed over the novelty of a two-year 
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computer science program articulating with a four-year MIS degree program in a 
business school. Since there is no Connecticut community college regulation 
that stipulates that new degree programs must be presented with already 
completed articulations with four-year schools, Dr. Belon could have avoided a 
great deal of aggravation had she not coupled the articulation agreement with the 
degree program. 

With the passage of the Computer Security degree program by the NCC faculty, 
the full degree package was sent to the Connecticut Community College Board 
of Governors on April 10, 2002. Over the next three weeks, the central office 
staff reviewed the application and called for minor changes. The degree was 
sent out for review, and is scheduled for action at the June 17, 2002 meeting of 
the Board of Governors. Assuming that the Board of Governors approves the 
degree, the final step will require the application package to be presented to the 
Connecticut Board of Higher Education for accreditation and licensure in 
September 2002. 

Conclusion 



Many more undergraduate cybersecurity degree programs are needed to meet 
the growing demand for security professionals in the public and private sectors. 

In order to better address the regional needs for security professionals, two-year 
and four-year educational institutions should involve area business and 
government professionals in the curriculum development process. The benefits 
of such a collaborative process are numerous: improved working relationships, 
new working relationships, additional networking opportunities, enhanced 
goodwill, and added public exposure for the organizations and educational 
institutions involved. In addition, stronger ties and quality programs between 
two-year and four-year institutions provide lasting benefits to the students and 
faculty, as well as to regional businesses. Both NCC and WCSU believe that the 
process followed in developing the Computer Security degree program has 
produced a quality program that will greatly benefit our institutions and our 
regional constituents. 




Page 8 



9 



07/24/02 WED 11:15 FAX 203 857 7296 



ACADEMIC AFFAIRS 




U.S. Department of Education 

Office of Educational Research and Improvement (OERI) 
National Library of Education (NLE) 

Educational Resources Information Center (ERIC) 

REPRODUCTION RELEASE 

(Specific Document) 




l DOCUMENT IDENTIFICATION: 



Study % Ct~£frh'ohk Ddyrec Prt>ynn^\ /Vi Conn 


paper- SecHrS-by 


Authors): ' &arbAt*-&cJo>^ , kdi-b. 9hal. t/Jr^h-h, Ph.T> . 


Corpora Source. bj/ftfriUhikj Ceh 's^e. 


Publication Data: 

Af#y H, Z<n>Z. 



IL REPRODUCTION RELEASE: 

In order to disseminate as vrfdaly as possible timely and significant materials of Interest to toe educational community, documents 
announced in Ihe monthly abstract Journal of the ERIC system, ftesou/ces in Bducatkm (RIE), are usually made available to users in microfiche, 
reproduced paper copy, and etectrante madia, and sold through the ERIC Document Reproduction Service (EDRS). Credit fc given to the source 
of each document, and, If reproduction release is granted, one of the foltowfng notices is affixed to the document 

If permission te granted to reproduce and disseminate the Identified document, please CHECK ONE of the faltoa/ing tore© options and sign 
at the bottom of toe page. 



The sample sticker shown below win be 
offered to aB Laval 1 documerts 


The s»mp}* attefcw shown below w-fl be 
offered to an Level 2A documents 


The sample sticker shown below win be 
effaced to all Level 2B documents 


peraasaoN to reproduce and 

DISSEMINATE THIS MATERIAL HAS 
BSN GRANTED BY 

JL& 




PERMISSION TO REPRODUCE AND 
DiSSaflNATE THIS MATERIAL IN 
M5CROFCHE. AND IN ELECTRONIC MEDIA 
FOR ERIC COLLECTION SUBSCRBStS ONLY. 
HAS BEEN GRANTED BY 






PERMISSION TO REPRODUCE AND 
DISSEMINATE THIS MATERIAL IN 
MICROFICHE ONLY HAS BEEN GRANTED BY 

Jfl 


ggtfr 




cjalflr 




t^T 


TO THE EDUCATIONAL RESOURCES 
INFORMATION CENTER (ERIC) 




IT 

TO THE EDUCATIONAL RESOURCES 
INFORMATION COTTER (EHIC) 




TO THE EDUCATIONAL RESOURCES 
INFORMATION CENTOS (ERIC) 






2A 




2B 




Level 1 

hero tor level 1 release, perm&irg 
ton end eflssemtttation fr> CT fcroffc te or 
ERIC archival rrocta (ag„ electronic) and 
paper copy. 



UveSSA 



Chock here to Level 2AraiM^pera*Sng re woduction 

anddlsserrtnaiion In trtcrafhhe end In electronic media for 
ERtC archival coihsctbri cutacrtoare oriy 



Level » 

Check here tor Level 28 retetraa. pernitHn® reproduction 
and dteseretoatfon tn microfiche onjy 



Documents w® t» processed as inrfcated provttad reproduction quality pennfe. 
ff pormisofoo to reproduo* « (pentad, but no bo* Is checked, documents will bo processed ot Lovell. 



/ hereby grant to the Educational Resources Information Center (&&C) nonexclusive permission to reproduce and cBssemtoate this document 
as indicated above Reproduction from the ERIC microfiche or etoctronic media by persons other than ERIC employees and its system 
contractors requires permission from the copyright holder. Exception o made far non-profit reproduction by fibranes and other service agendas 
to satisfy information needs of educators in response to discrete inquiries. 




Prt^ Nart^Poartsir/r^ U/rEufctr , C IT" 

bfrbctfaj. Hufihx* d*~ &e/o* 


v****™***** (/ ffl //omr 4 Ik bmmm/k. Catlap. 

1 JSf Richards Avcku*- /foruJaik cr olxS'f 


T 3sr- *si- 1,?^ 


FA $rS 7* 7297 


EMail Address 


°“7 /zifox- 



bbeio+i (pnec. .cj/jyrhnef.eJh 



III. DOCUMENT AVAILABILITY INFORMATION (FROM NON-ERIC SOURCE): 

If permission to reproduce is not granted to ERIC, or, if you wish ERIC to cite the availability of the document from another source, please 
provide the following information regarding the availability of the document. (ERIC will not announce a document unless it is publicly 
available, and a dependable source can be specified. Contributors should also be aware that ERIC selection criteria are significantly more 
stringent for documents that cannot be made available through EDRS.) 




IV. REFERRAL OF ERIC TO COPYRIGHT/REPRODUCTION RIGHTS HOLDER: 

If the right to grant this reproduction release is held by someone other than the addressee, please provide the appropriate name and 
address: 




V. WHERE TO SEND THIS FORM: 



Send this form to the following ERIC Clearinghouse: 



<6.- C Ci-ILOo^ «n c/ [xxnAy^s^, r~Lp~L. C/3— 

•50 5 i HtOJl/UCLA J 

cfSI SSL \ 

~^<s-o Qsncjs<J , CA - O S - 15 2- 1 



However, if solicited by the ERIC Facility, or if making an unsolicited contribution to ERIC, return this form (and the document being 
contributed) to: 



EFF-088 (Rev. 2/2000) 

O 



ERIC Processing and Reference Facility 
4483-A Forbes Boulevard 
Lanham, Maryland 20706 

Telepl 2^4200 

Toll F 1-3742 

FA 700 

ericfac@inet.ed.gov 
http://ericfac.piccard.csc.com 



ERLC 




